feat(activities): let creators lock edit and delete to themselves

Add editPolicy (default creator-only), enforce it in the API, surface clear permission messages, and drop the redundant edit menu now that detail is editable.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/prisma/migrations/20261111160000_activity_edit_policy/migration.sql

@@ -0,0 +1,5 @@
+-- CreateEnum
+CREATE TYPE "ActivityEditPolicy" AS ENUM ('creator', 'assignees');
+
+-- AlterTable
+ALTER TABLE "Activity" ADD COLUMN "editPolicy" "ActivityEditPolicy" NOT NULL DEFAULT 'creator';